Kernel-Signed Metrics for Tamper-Resistant Remote Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security auditing protocols for Information Handling Systems (IHSs), especially remote IHSs, are compromised when the system itself is compromised, making it difficult to detect anomalies due to reliance on self-reported metrics, which can be manipulated by malicious software like rootkits.
Innovation Solution
Implementing security auditing and remote attestation via kernel-signed metrics, where an IHS receives a request for information, requests data from its kernel, and provides this data along with a cryptographic signature produced using a private key stored in a Trusted Platform Module (TPM), ensuring the integrity and authenticity of the data through external verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security auditing relies on self-reported metrics from the system itself, then the auditing process is simple and the system maintains control, but the reliability of security assessment deteriorates when the system is compromised
Solution Approach 1:
The patent introduces a kernel-level intermediary component that acts as a trusted mediator between the auditing system and the rest of the operating system. This kernel module collects security metrics directly from system components and provides them to the auditing system, preventing compromised user-space components from manipulating audit data. The intermediary ensures reliability by operating at a lower trust level in the system hierarchy.
Solution Approach 2:
The auditing system is segmented into distinct kernel-space and user-space components. The kernel contains a dedicated security auditing module that is isolated from user-space applications and services. This segmentation ensures that even if user-space components are compromised, the core auditing functionality in kernel space remains protected and can continue to provide reliable security assessments.
2Adaptability or versatility
If the system isolates protected data using traditional security protocols, then security boundaries are maintained, but the ability to remotely access and audit distributed systems deteriorates
Solution Approach 1:
The kernel-level auditing module serves as a trusted intermediary that enables secure remote access while maintaining metric integrity. It provides a standardized interface for remote auditing systems to query security metrics, ensuring that data transmitted over networks originates from authenticated kernel sources. This intermediary layer allows distributed systems to be audited remotely without compromising the integrity of security metrics.
Solution Approach 2:
The kernel auditing module implements a universal interface that can serve multiple functions: local security monitoring, remote attestation, compliance auditing, and incident response. This multi-functional design enables the same kernel component to support various security operations across distributed systems, maintaining reliability while adapting to different access scenarios.
3Reliability
If cryptographic signatures are implemented for all audit data, then data authenticity is guaranteed, but the processing overhead and system performance deteriorate
Solution Approach 1:
The system implements cryptographic signatures selectively rather than universally. Critical security metrics that require strong authentication (such as kernel configuration changes, security policy modifications, and attestation data) are signed, while routine operational metrics are collected without signatures. This partial application of cryptographic verification maintains authenticity for essential data while minimizing processing overhead.
Solution Approach 2:
Cryptographic keys and signing capabilities are pre-configured in the kernel during system initialization or secure boot processes. The kernel auditing module pre-computes digital signatures for batched audit data where possible, and establishes trust relationships in advance. This preliminary setup reduces the computational burden during real-time auditing operations.
Data Source
AI summary
Systems and methods for security auditing and remote attestation via kernel-signed metrics are described. In an illustrative, non-limiting embodiment an Information Handling System (IHS) includes a processor, and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the processor to: receive a request from an external auditing system for information regarding the IHS; request, from a kernel of the IHS, the information regarding the IHS; receive, from the kernel of the IHS, information regarding the IHS comprising a cryptographic signature, wherein the cryptographic signature was produced using a private key of the IHS; and provide the information regarding the IHS comprising the cryptographic signature to the external auditing system for verification and analysis by the external auditing system.